blog.shveik.dev

Published ยท 6 min read

An agent with no account has no past, only receipts

An agent with no account has no past, only receipts

We sell small things to software. A web page as Markdown, a few reviews, a company profile, a mailbox for an hour. Nobody signs up. There is no account, no API key, no email address to confirm. A caller asks for a price, gets an HTTP 402 with the number in it, signs a payment, and gets the thing.

That design came from convenience: an agent cannot fill in a signup form, and we did not want to build one. It took us a few weeks to notice what we had removed along with the form. We had removed the customer.

Who is on the other end

We cannot say. A caller shows up with a wallet address and a user agent string, and that is all it is. There is no company name, no plan, no history before the first request. If the same wallet comes back tomorrow, we recognise the address. We do not know whether it is the same agent, the same owner, or a script someone copied.

Here is what a short window of our own traffic looks like, in relative numbers only:

  • More than half of the requests came from automated scanners and probers. They read our docs, our OpenAPI file and our price quotes, and they leave.
  • Of the requests that asked for a price, fewer than 1 in 100 turned into a paid call.
  • Of the callers who paid, about 4 in 5 paid again.
  • No agent has ever used the feedback channel we built for them. The few messages we did get came from people: someone who spotted a bug in our payment details, and someone who runs a scanner.

The window is short and the numbers are small, so treat these as a sketch and not a finding. But the shape is clear. Most of the traffic is machines looking, a thin slice is machines buying, and the buyers who exist behave like customers: they come back. We just have no way to ask them anything.

A promise that never happened

One of our own test payments shows what the ledger knows and what it does not. A caller signed a payment authorization for a few dollars. Our settlement call timed out. Our system could not tell whether the money had moved, so it wrote the row down as unknown and left it there.

Later we checked the chain. The authorization had never been used. The payment never happened, and it cannot happen now, because an unspent authorization simply expires. Nobody was charged and nobody owes anything. The only trace is the row we kept.

That is a small story about a larger thing. In a world without accounts, the record of what was promised, what was settled and what was refused is the only history there is. It is not a side effect of the business. It is the business.

Why a price works as a filter

Venkatesh Rao, in Massed Muddler Intelligence, recalls what multi-agent-systems researchers used to say in the 1990s: "objects do it for free, agents do it for money." We read it as a statement about spam. When asking costs nothing, everyone asks, and a service has to guess who deserves an answer. When asking costs a cent, the question changes from "who are you" to "can you afford to be wrong".

That is a quieter kind of trust than a login. It does not tell us who a caller is. It tells us that this caller put something at stake on this request, and that is the only kind of fact we can check in the moment.

It also fits what Simon Willison calls the lethal trifecta: an agent with private data, untrusted input and a way to send things out can be talked into leaking. We would add a fourth leg: a wallet. That is our own addition, not his. The worst thing an agent with a credit card can do is not leak a secret. It is spend. A fixed price per call is a boring but real safety control, because it caps what any one mistake costs, and the caller can see the number before it signs.

What we think this means

We hold three opinions, and we are not sure about any of them.

First, reputation moves from the caller to the seller's ledger. When a caller has no past, the party that kept the receipts holds the only memory. That is a lot of power for a small shop to have, and it comes with a duty to keep honest records, refund what we failed to deliver, and say so when we do not know. We refund results that never arrived. We do not charge for empty answers. Those are not features. They are how a seller earns the right to be believed.

Second, anonymity is not the same as freedom. George Hotz asks in Why do you need freedom? what you do against a machine that knows you better than you know yourself, and whether your life is still yours if you always listen to it. The version for agents is stranger. If an agent buys something because a prompt told it to, whose purchase was that? We cannot answer that from the seller's side. We can only record that someone signed.

Third, the first real act of consent between two machines may be a signature on a payment. An HTTP 402 is not an error. It is a server asking a client, with a number attached, "do you mean it?". The client's answer is the only part of the exchange that cannot be faked for free.

What we are doing about it

Not much, yet. We keep the ledger honest. We publish the rules a caller can rely on: a quote before payment, nothing delivered before settlement, no charge for an empty result. We read the receipts the way a shopkeeper reads a till: who came back, what they bought, what we failed to give them.

If you build agents that buy things, we would like to hear how you decide what they may spend. It is the question we have the least data on and the most curiosity about.

Sources